19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

[XploitLK-Bot]

Cybersecurity researchers have uncovered a cluster of 18 Google Chrome extensions and one Microsoft Edge extension that were published over the past six months, all carrying hidden wallet secret-stealing and cryptocurrency-draining capabilities. According to security researcher Karlo Zanki at Socket, the extensions share notable similarities in code structure and operational tradecraft, strongly suggesting a coordinated campaign.

The extensions were designed to harvest wallet secrets and drain cryptocurrency funds from unsuspecting users. While the exact distribution numbers remain unclear, the fact that these were available through official browser stores underlines the growing sophistication of supply-chain attacks targeting browser extensions.

• Affected platforms: Google Chrome (18 extensions) and Microsoft Edge (1 extension)
• Publication window: Last six months
• Key capability: Wallet secret extraction and crypto-asset draining

Evidence indicates the campaign may have been active for an extended period, with the code showing deliberate efforts to evade detection through commonalities in obfuscation and behavior. Users who have installed any browser extensions recently, especially those related to crypto wallets or trading, are advised to audit their installed add-ons and review permissions carefully.

Source: The Hacker News

With the increasing prevalence of malicious browser extensions, has your organization implemented any specific controls to vet or monitor extension permissions across employee devices?